Emlog: Path Traversal in emUnZip() erlaubt beliebiges Schreiben von Dateien, was zu RCE führt

The primary impact of CVE-2026-34607 is the potential for complete server compromise. An attacker, posing as an authenticated administrator, can upload a specially crafted ZIP file containing entries with directory traversal sequences (e.g., ../../). This allows them to write arbitrary files to the server's filesystem, effectively bypassing access controls. The most common payload would be a PHP webshell, granting the attacker persistent remote access and control over the web server. This could lead to data theft, modification, or deletion, as well as the deployment of further malicious software. The blast radius extends to any data stored on the server and potentially to other systems accessible from the compromised server.

Emlog CMS installations, particularly those running versions 1.0.0 through 2.6.2, are at risk. Shared hosting environments that utilize Emlog CMS are especially vulnerable, as they often have limited control over server configurations and security settings. Administrators who have not implemented robust file upload validation or access controls are also at increased risk.

• linux / server:

find /var/www/emlog -type f -name '*.php' -exec grep -i 'emUnZip\(' {} + | journalctl -f

• generic web:

curl -I http://your-emlog-site.com/wp-admin/admin-ajax.php?action=upload_plugin&file=../../../../../../etc/passwd | grep 'Content-Type:'

• php:

Get-ChildItem -Path "C:\xampp\htdocs\emlog\include\lib" -Recurse -Filter "common.php"

1. 2026-04-03Disclosure

   disclosure

2. 2026-04-03Patch

   patch

1. Reserviert2026-03-30
2. Veröffentlicht2026-04-03
3. Geändert2026-04-06
4. EPSS aktualisiert2026-04-11

The recommended mitigation for CVE-2026-34607 is to immediately upgrade Emlog CMS to version 2.6.3 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file uploads to only trusted sources and implement strict file type validation. Configure a Web Application Firewall (WAF) to block uploads of ZIP files with suspicious filenames containing directory traversal sequences (e.g., ..). Monitor file system activity for unexpected file creations or modifications, particularly in sensitive directories. Review and strengthen authentication mechanisms to prevent unauthorized administrator access. After upgrading, verify the fix by attempting to upload a test ZIP file with a malicious path traversal entry; the upload should be rejected.